Confidant Repair Terms / 私约修复条件机制

Confidant Repair Terms makes the aftermath of a breached private promise playable. The mechanism begins after a promise has already been violated, softened, exposed, or converted into public/sponsor/lawful proof outside the original scope.

The design rule is simple: the harmed character authors the repair terms. The producer may accept, negotiate, shield, separate, refuse, or fake the repair, but cannot convert apology into universal forgiveness.

Trigger surface

confidant_repair_trigger:
  trigger_kind: state_pressure
  source_promise_or_breach_visible: true
  confidant_character_visible: true
  breached_material_visible: true
  violated_scope_visible_or_explicit_absence: true
  breach_reader_visible: true
  character_harm_claim_visible: true
  demanded_repair_visible: true
  proof_required_by_character_visible_or_explicit_absence: true
  future_character_or_route_consumes_repair_state: true
  player_can_accept_negotiate_contrit_shield_separate_refuse_or_default: true
  no_fixed_turn_trigger: true
  no_fixed_day_or_week_trigger: true
  no_raw_breach_count_trigger: true
  no_dashboard_or_lens_health_trigger: true

Invalid entries include generic apology scenes, relationship thresholds, romance/affinity state, fixed sequence position, raw promise count, dashboard state, lens health, or public contrition that cannot alter a future character or route reader.

State model

The mechanism stores three locks separately.

repair_locks:
  breach_lock:
    source_promise_id_or_absence: <promise id or explicit_absence>
    confidant_character: <named character>
    breach_state_before: breached | hostile | exposed | public_only | lawful_only | sponsor_only | missed | recovery_only | equivalent
    breached_material: <material>
    violated_scope: <scope or explicit_absence>
    breach_reader: <reader>
  term_lock:
    harm_named_by_character: <harm claim>
    demanded_repair: return_material | replace_proof | publish_boundary | shield_source | pay_witness | withdraw_recap | route_separation | public_contrition | handler_recusal | equivalent
    proof_required_by_character: oath | receipt | checksum | public_addendum | lawful_seal | witness_payroll | route_quarantine | explicit_absence | equivalent
    nonnegotiable_limit: <limit or explicit_absence>
  future_lock:
    selected_repair_posture: accept_terms | negotiate_restitution | public_contrition | shielded_repayment | route_separation | refuse_repair | performative_apology_default
    repair_state_after: pending | accepted | partial | public_contrition | shielded | route_separated | refused | performative | hostile | missed | recovery_only | equivalent
    future_character_or_route_effect: <future consumer mutation>

A character can accept a public apology and still ban sponsor reuse. A route can reopen while the character remains handler-only. A lawful repair can fail in public. None of these states may collapse into one trust flag.

Branch families

The mechanism must expose these branch families through 私约修复面谈 or an equivalent rite:

Branch	Relief	Cost	Future scar
Accept terms	demanded repair becomes legitimate	proof replacement, schedule cost, sponsor/archive pressure	scoped route reopened, recruitable with cost, addendum required
Negotiate restitution	narrower repair is mutually visible	consent debt, notice burden, character route costlier	partial repair, split reader, future objection preserved
Public contrition	harmed public or character sees acknowledgement	license pressure, sponsor pressure, public distrust	public repair route opens; sponsor route narrows
Shielded repayment	witness/source gets protection or payment	payroll, handler burden, lawful delay	protected witness state, lawful-only proof, route delay
Route separation	character avoids the contaminated route	proof gap, missed scenes, route asset cost	character elsewhere, this route blocked or costlier
Refuse repair	proof/schedule pressure is preserved now	hostile character, recruitability damage, ending scar risk	hostile witness, missed recruit, recovery-only branch
Performative apology default	desk pressure may fall briefly	false repair hardens	hostile/unavailable/missed/recovery-only future

No branch may create universal forgiveness across character, public, lawful, sponsor, archive, management, route asset, and broadcast-reality readers.

Counter and route contract

Every non-default resolution must mutate all three categories:

counter_deltas_required:
  relief: at_least_one
  cost: at_least_one
  future_character_or_route_effect: at_least_one

Expected surfaces include confidant_repair_legitimacy, character_availability, recruitability, missability, proof_replacement_cost, witness_protection_cost, handler_burden, public_receipt_distrust, sponsor_capture, archive_debt, producer_license_pressure, broadcast_reality_drift, route_asset_access_cost, future_recovery_cost, and ending_scar_pressure.

Default behavior

私约修复默认 fires or arms when a breached promise is treated as repaired without character-authored terms, proof of repair, a preserved nonnegotiable limit, or a future route mutation.

Acceptable default consequences include false repair recorded, character terms hidden, sponsor-only repair, public-only repair, lawful-only repair, handler recusal required, hostile confidant witness, recruit missed, route separated, recovery-only route, or ending scar.

Relation to existing systems

• 私约承诺账本 supplies the breached promise row, but does not decide repair.
• 私约违背线 creates breach pressure; this mechanism begins when the breach becomes a repair demand.
• 公开悔过账本 can satisfy only the public-contrition branch, not all demanded repairs.
• 受保护证人薪册 can pay or shield a source when that is the demanded repair.
• 处理人负荷账本 absorbs the labor cost of mediation, witness shielding, or recusal.
• Route Assets and Custody must read whether the character is repaired, partial, separated, hostile, missed, or recovery-only.
• Broadcast Reality may echo false repair; the false repair state must remain visible.

Non-goals

• Not a forgiveness meter.
• Not a generic apology scene.
• Not a romance repair mechanic.
• Not a clean proof converter.
• Not a bulk route unlock.
• Not valid without named harm, demanded repair, proof of repair, and future reader consumption.